Home / Vulnerability Database / Ruby : Using "send" version, designed for testing
Ruby

Ruby : Using "send" version, designed for testing

Overview

send usage may cause undesired access to private (protected) fields of the class.

Notes:

  • besides testing private fields, send (__send__) commonly used for dynamically generated class fields and methods;
  • even if your application forces the user to choose from fixed alternatives inside the UI, it’s not going to save you from editing of the request;
  • you can redefine send as your function, then you can access built-in method through __send__.
LOW

DerScanner Severity Score

Do you want to fix Ruby : Using "send" version, designed for testing in your application?

See also

Ruby

Ruby : Weak hashing algorithm

Ruby

Ruby : Empty encryption key

Ruby

Ruby : Hardcoded sensitive data